AXIS Communications - Cross-Site Scripting / Content Injection(CVE-2015-8258)

Technical Details The variable "imagePath=" that is prone to XSS in a large range of products also can be used to resource injection intents. If inserted a URL in this variable will be made an GET request to this URL, so this an interesting point to request malicious codes from the attacker...

YUNUCMS Cross-Site Scripting Vulnerability

YUNUCMS is China Yunyou YUNU network technology company of a set of open source enterprise station building content management system CMS. YUNUCMS version 1.0.7 cross-site scripting vulnerabilities. A remote attacker can inject arbitrary Web script or HTML with the help of content headings on the...

Samsung Display Solutions Application For Android Content Injection Vulnerability

Samsung Display Solutions Application for Android did not use encryption SSL for information transmission, thus allowing a man-in-the-middle attacker to inject their own content into the application. The vendor fixed this issue and users should install the latest version 3.02 or above. Original...

CVE-2017-10963

In Knox SDS IAM Identity Access Management and EMM Enterprise Mobility Management 16.11 on Samsung mobile devices, a man-in-the-middle attacker can install any application into the Knox container without the user's knowledge by inspecting network traffic from a Samsung server and injecting conten...

PT-2018-5308

Name of the Vulnerable Software and Affected Versions Knox SDS IAM and EMM version 16.11 Description A man-in-the-middle attacker can install any application into the Knox container without the user's knowledge by inspecting network traffic from a Samsung server and injecting content at a certain...

Microsoft ASP.NET Core Elevation of Privilege Vulnerability (CNVD-2018-00899)

Microsoft ASP.NET Core is a cross-platform open source framework from Microsoft Corporation USA. The framework is used to build cloud-based applications such as web applications, IoT applications, and mobile backends. An elevation of privilege vulnerability exists in Microsoft ASP.NET Core versio...

ASP.NET Core Elevation Of Privilege Vulnerability

An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests. An attacker who successfully exploited this vulnerability could perform content injection attacks and run script in the security...

Microsoft Exchange Spoofing Vulnerability

Microsoft Exchange Server 2016 is a suite of email service programs from Microsoft USA that provides email access, storage, forwarding, voicemail, email filtering and screening, etc. CU6 and CU7 are 2 of the cumulative updates. A security vulnerability exists in Microsoft Exchange Server 2016 CU6...

Microsoft Exchange Spoofing Vulnerability

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App OWA fails to properly handle web requests. An attacker who successfully exploited the vulnerability could perform script or content injection attacks, and attempt to trick the user into disclosing sensitive...

Security Updates for Exchange (December 2017)

The Microsoft Exchange Server installed on the remote host is missing a security update. It is, therefore, affected by the following vulnerability : - A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access OWA fails to properly handle web requests. An attacker who...

PT-2017-12314

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2016 versions CU5 Description A spoofing issue exists due to the way Outlook Web Access OWA validates web requests. This could allow an attacker to perform script or content injection attacks and attempt to trick the...

CVE-2017-12347

Multiple vulnerabilities in Cisco Data Center Network Manager DCNM Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect a user to a malicious website, inject malicious content into a DCNM client interface, or conduct a cross-site scripting...

PT-2017-12511

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager DCNM Software affected versions not specified Description The issue allows a remote attacker to inject arbitrary values into configuration parameters, redirect a user to a malicious website, inject malicious...

PT-2017-12508

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager DCNM Software affected versions not specified Description The issue allows a remote attacker to inject arbitrary values into configuration parameters, redirect a user to a malicious website, inject malicious...

PT-2017-12509

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager DCNM Software affected versions not specified Description The issue allows a remote attacker to inject arbitrary values into configuration parameters, redirect a user to a malicious website, inject malicious...

CVE-2017-12347: Improper Neutralization of Input During Web Page Generation

Multiple vulnerabilities in Cisco Data Center Network Manager DCNM Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect a user to a malicious website, inject malicious content into a DCNM client interface, or conduct a cross-site scripting...

PT-2017-12512

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager DCNM Software affected versions not specified Description The issue allows a remote attacker to inject arbitrary values into configuration parameters, redirect a user to a malicious website, inject malicious...

PT-2017-12510

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager DCNM Software affected versions not specified Description The issue allows a remote attacker to inject arbitrary values into configuration parameters, redirect a user to a malicious website, inject malicious...

Design/Logic Flaw

A stored web content injection vulnerability WCI, a.k.a XSS is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an...

CVE-2017-1000223

A stored web content injection vulnerability WCI, a.k.a XSS is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an...